API.md ships in the image; GET /api/docs/approved serves it behind api:docs

Moved to app/API.md so the build context carries it. The console renders
it at /leaders/api. tests/smoke_admin.py 162 -> 164.

tests/smoke_admin.py

@@ -420,6 +420,11 @@ check("fbposts caps: read for leaders, ingest admin-only and scopable", "fbposts
 con = S.connect(); con.execute("DELETE FROM fb_posts"); con.commit(); con.close()
 import os as _os; _os.remove(S.image_path(r))
 
+print("\napproved doc")
+import pathlib as _pl
+check("API.md ships beside the app", (_pl.Path(A.__file__).with_name("API.md")).exists() and "## How to call it" in _pl.Path(A.__file__).with_name("API.md").read_text())
+check("/api/docs/approved is gated like /api/docs", any(r.path == "/api/docs/approved" for r in A.docs_router.routes))
+
 print("\napi docs registry")
 import admin_api as A
 reg = A.describe_routes()